Privacy Policy

1. Who controls your data

Most people use Praxis AI through a school, college, training program, or employer. In that case your organization controls your data and we act on its instructions (in legal terms, we are a "processor," "service provider," or - for U.S. schools - a "school official" under FERPA). Your organization decides which features are turned on, including AI, voice, and memory. If you want something changed or deleted in an organization-managed account, ask them first; we'll help them do it.

When you sign up on your own, or when we handle our website, billing, security, or business contacts, Praxis AI is in charge of the data directly.

If a signed agreement between us and your organization says something different from this policy, the agreement wins for that organization's data.

2. What we collect

We collect only what we need to run the product. Here's the full list.

Things you or your organization give us

• Account basics: name, email, username, password, organization, role, profile and accessibility preferences, avatar settings.
• Learning context (when a school provides Praxis AI): LMS IDs, course and enrollment info, class membership, assignments, progress, and - where the school authorizes it - grades, assessment answers, and other education records.
• Your content: prompts, messages, uploaded documents and images, audio notes, transcripts, feedback, code, datasets, conversation history, and "memory" entries you choose to save.
• IP Vault knowledge: the documents you or your organization load into a Digital Twin's knowledge base, plus the text extracts, search indexes ("embeddings"), and settings we derive from them so the Twin can find and cite the right passage.
• Voice, audio, and video: your live voice during a conversation, transcripts, synthesized speech we generate back to you, and avatar session data - only when you use those features.
• Billing and admin info: plan, credits, transaction records, instance and integration settings, support messages.
• Connected services: data from Canvas, D2L, Google Workspace, Microsoft 365, single sign-on providers, LTI tools, Kaltura, or other integrations - only when you or your organization turn them on and authorize the scope.

Things collected automatically

• Usage and log data: IP address, browser and device type, pages and features used, request times, errors, token and credit usage, and security events.
• Mobile app data: app version, operating system, device settings, push notification tokens, crash logs.
• Cookies: to keep you signed in, remember preferences, protect against abuse, and measure performance. No advertising cookies (Section 12).
• Location: we do not collect precise GPS location. We may infer a general region from your IP address for security and regional settings.

Things we don't want. Please don't give us sensitive personal data (health, biometrics, government ID numbers, payment card numbers) unless your organization has set up the product for that purpose. Payments go through Stripe or your app store - we never see your card number.

3. How we use it

• To create and secure your account and deliver Pria, Digital Twins, IP Vault, and integrations.
• To process the files and questions you submit and generate answers, summaries, speech, and avatars.
• To personalize your experience (preferences, history, memory) when you or your organization enable it.
• To run learning experiences your school configures, including LMS workflows.
• To support you, bill you, and keep the lights on.
• To detect and stop abuse, fraud, security attacks, and attempts to manipulate the AI.
• To measure reliability and improve the product - using aggregated, de-identified usage statistics, never your content.
• To meet legal obligations.

What we never do: sell your data; share it for targeted advertising; profile students or market to them or their families; or use your content to train any AI model - ours or anyone else's.

4. How AI processing works (please read this one)

Praxis AI is built on top of AI models from other companies. When you type a prompt, talk to a Digital Twin, or upload a file, the parts needed to answer you are sent to one or more of these providers, which generate a response and send it back. Without this step there is no product.

What gets sent: your prompt and relevant conversation history; your voice (for voice features); files you upload and text extracted from them; passages retrieved from an IP Vault to answer your question; images you submit; and minimal technical metadata to route and secure the request.

Who receives it:

The rules they must follow. Every provider signs a written agreement requiring it to: use your data only to produce your response; never train or improve its models on your content; never use it for advertising, profiling, or any purpose of its own; never sell or pass it on (except to its own vetted subcontractors under the same rules or when the law requires); and protect it with security at least as strong as ours. For the providers Praxis AI manages, we contract for zero data retention: your content is processed for the moment it takes to answer and is not stored afterward.

Two honest limits. (1) A few providers keep limited request metadata, or content for a short, contract-bound period, for abuse monitoring that we can't switch off. Where this happens it is time-limited, access-restricted, and never used for training. (2) If your organization plugs in its own AI provider credentials, that provider's terms apply instead of ours - ask your organization.

Zero retention at the provider is separate from what's stored in your Praxis AI account - your conversation history, memory, and IP Vault files stay there until you or your organization delete them (Section 10).

Not every provider is active everywhere. Organizations enable providers per deployment and can request the exact list for their instance.

Voice and likeness. Audio is captured only while a voice feature is active and you've granted microphone permission. We do not create voiceprints, faceprints, or any biometric identifier, and we don't let our providers do so. When a Digital Twin uses a real person's voice or likeness, that person gives express written consent first and can withdraw it.

AI doesn't make big decisions about you. We never let AI alone decide admissions, enrollment, employment, discipline, or final grades. Where a school uses Praxis AI to help with feedback or assessment, the output is a recommendation to a human, and the school owns the decision. If you believe an automated decision affected you, contact your institution or privacy@praxis-ai.com to request human review.

AI can be wrong. We tell you when you're talking to an AI and label AI-generated content. Please check important output before relying on it for academic, professional, financial, legal, or medical purposes.

5. Who else touches your data (subprocessors)

Beyond the AI providers above, these companies help us run the service. All of them are under written data-protection terms and are reviewed before and during use. Everything is processed in the United States.

The always-current list lives at praxis-ai.com/subprocessors and controls if it differs from this table. We update it before a new subprocessor starts, and organizational customers can subscribe to change notices and object under their agreement.

6. When we share information

We share personal information only as follows:

• With your organization. Administrators, instructors, and staff can see account details, usage, interactions, progress, uploads, and AI activity according to their permissions and your organization's setup.
• With the AI providers and subprocessors above, strictly to deliver the service. This is not "sharing" in the sense of handing your data to someone for their own use - they work for us, under our rules, and give it back.
• With services you connect (Canvas, Google, Microsoft, etc.), within the scopes you or your organization authorize.
• When you ask us to.
• When the law requires it - subpoena, court order, or lawful government request. For student data we notify the school first unless legally barred or there's an emergency.
• If Praxis AI is acquired or reorganized. The buyer inherits these promises, and we'll notify you before your data becomes subject to a materially different policy.

Prefer your content never go to an AI provider? Don't use the AI features - account, course, and file-storage functions still work - or ask your administrator to disable AI, voice, and avatar features for your organization.

We have not sold or shared personal information (as California law defines those terms), including for anyone under 16, in the past 12 months.

7. Students, children, and schools

• FERPA. When a U.S. school provides Praxis AI, we act as a "school official" with a legitimate educational interest. The school controls its education records; we use them only to deliver the contracted service, keep it secure, and support it. Parents and eligible students should send record requests to the school; if you contact us instead, we'll route it there and help.
• Children under 13. Our consumer service isn't for children under 13. In K-12 settings, the school obtains any parental consent required under COPPA. If we learn we've collected a child's data without proper authorization, we delete it.
• State student privacy laws (California SOPIPA/AB 1584, New York Ed Law §2-d, Illinois SOPPA, Colorado, and others). We will not sell student data, use it for targeted ads, build commercial profiles, or keep it past the end of the school's contract except as the law allows. Student data belongs to the school.

8. Your rights and choices

Depending on where you live, you can:

• See what we hold about you and how it's used
• Correct it
• Delete it
• Export it in a portable format (CSV, JSON, SQL)
• Restrict or object to certain processing
• Withdraw consent (for example, turn off voice or memory)
• Opt out of sale, sharing, or targeted advertising - which we don't do anyway
• Appeal if we decline a request
• Complain to your data-protection authority or U.S. state attorney general

How: Most of this is in your account settings - export, delete, and controls for memory, personalization, and voice. In the mobile app, Settings → Delete Account removes your account and its data. If your account belongs to an organization, we'll route the request to them and tell you we did.

Otherwise email privacy@praxis-ai.com. We answer verified requests within 30 days (GDPR) or 45 days (U.S. state laws), extendable where the law allows, and we'll tell you if we need more time. No fee, no retaliation. We may verify your identity first; authorized agents need proof of authority.

Our website honors the Global Privacy Control browser signal. You can unsubscribe from marketing email anytime; we'll still send security and account notices.

9. The mobile apps (iOS and Android)

Everything above applies to the apps. In addition:

• AI consent screen. Before the app sends anything to a third-party AI provider, it shows you who the providers are, what will be sent (prompts, voice, uploaded files), and why (only to answer you). You must agree first. You can withdraw in the app's settings; AI features pause while withdrawn.
• Permissions are asked only when needed, and you can revoke each in your device settings:

• No tracking. The app does not track you across other companies' apps or websites, does not use advertising SDKs, and never asks for tracking permission. Our App Store and Google Play data disclosures match this policy.
• Purchases made in-app are handled by Apple or Google under their privacy policies.

10. How long we keep things

Organizations set their own retention and export terms in their contracts, typically with a transition period before deletion.

11. How we protect it

• Encryption: AES-256 at rest; TLS 1.2 or higher in transit (1.3 preferred).
• Access: role-based, least-privilege, tenant isolation, mandatory multi-factor authentication for administrators, SSO support.
• Operations: audit logging, vendor reviews, secure development, vulnerability management, change control.
• Testing: regular independent penetration testing.
• Compliance: SOC 2 Certified; the next audit report, on operating effectiveness, is expected in 2027. HECVAT and VPAT available to customers under NDA.

Our people don't read your stuff. Praxis AI staff access customer content only when you or your administrator ask for help, to investigate a security incident or credible misuse report, when the law requires, or on your organization's instruction. Access is by named individual, approved by our CTO and CEO, time-limited, logged, and MFA-protected.

If something goes wrong, we investigate, contain it, and notify affected customers - and individuals and regulators where required - without undue delay and within legal and contractual timeframes. Schools are notified so they can meet their own obligations. Report vulnerabilities to security@praxis-ai.com.

No system is perfectly secure. Please keep your password private and tell us right away if you suspect misuse.

12. Cookies

We use strictly necessary cookies (sign-in, security), functional cookies (preferences), and limited analytics cookies (performance). No advertising or cross-site tracking cookies, and no third-party ad cookies on our services. Where the law requires, a banner lets you accept or reject non-essential cookies. Your browser settings control the rest.

13. If you're outside the United States

Praxis AI and its subprocessors process data in the United States. If you're in the EEA, UK, or Switzerland, your data is transferred here under the European Commission's Standard Contractual Clauses (with the UK Addendum where applicable), plus encryption, access controls, and a policy of challenging overbroad government requests. Our subprocessors sign equivalent onward-transfer terms. You can request a redacted copy at privacy@praxis-ai.com.

Legal bases (GDPR/UK GDPR). When your organization controls the data, it sets the legal basis. When we do, we rely on: contract (running your account and the service); legitimate interests (security, reliability, business communications, defending legal claims); consent (voice, memory, and personalization features you switch on; marketing where required); legal obligation (tax, accounting, lawful requests); and public task where a public institution is the customer. We don't need special-category data and process any you volunteer only with your explicit consent. You can withdraw consent anytime without affecting earlier processing, and you can ask for a summary of our legitimate-interests assessments.

14. Changes to this policy

When we change this policy we update the date at the top. For material changes we give prominent notice - in the product or by email - before they take effect, and for schools we provide advance notice and obtain required approvals where law or contract requires. Prior versions are available on request.

15. Contact us

• Privacy requests and questions: privacy@praxis-ai.com
• Security: security@praxis-ai.com
• Anything else: humans@praxis-ai.com
• Mail: Praxis AI, Inc., 6701 Koll Center Parkway, Suite 250-2656, Pleasanton, CA 94566, USA
• EEA/UK/Swiss residents: our data protection representative is above; you may also complain to your local supervisory authority.

If you use Praxis AI through a school or employer, they can also answer questions about their own settings and procedures.